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USPAT; 
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EPO; JPO; 
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IBMJTDB 


OR 


OFF 
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S4 
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US-PGPUB; 

USPAT; 
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OR 
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DERWENT; 
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OR 


OFF 
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OR 


OFF 


2005/03/10 11:52 
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1 . A method for identifying a computer virus in interpreted language source code, the 
method comprising: 

Receiving a portion of interpreted language source code; 

Generating a language-independent representation of the portion of the interpreted 

language source code; 

Comparing the language-independent representation with a virus signature; and 
Determining if the language-independent representation matches the virus 

signature, whereby a match indicates a computer virus has been identified. 

2. The method of claim 1, wherein the interpreted language source code is a scripting 
language source code. 

3. The method of claim 1, wherein the virus signature is a language-independent 
representation of an interpreted language source code computer virus. 

4. The method of claim 1, wherein the portion of interpreted language source code and 
the virus signature are represented as a linearized string of key actions. 

5. A method for generating a virus signature, the method comprising: 

Receiving a portion of interpreted language source code containing a computer 

virus; 

Generating a language-independent representation of the computer virus; and 
Storing the language-independent representation of the computer virus as a virus 
signature. 

6. The method of claim 5, wherein the interpreted language source code is a scripting 
language source code. 

7. The method of claim 5, wherein the virus signature is compiled in binary format. 

8. The method of claim 5, wherein the language independent representation is a 
linearized string of key actions. 

9. The method of claim 5, wherein the virus signature includes input from a virus 
analyst. 

10. The method of claim 5, further comprising: 

Parsing the portion of interpreted language source code into tokens; and 
Generating the language-independent representation of the computer virus using 
at least a portion of the tokens. 

1 1 . A method for identifying a virus in interpreted language source code, the method 
comprising: 

Receiving a portion of interpreted language source code; 

Parsing the portion of the interpreted language source code into tokens to generate 
a tokenized source code, wherein at least some of the tokens represent key actions; 



Extracting selected key actions from the tokenized source code, 
Linearizing the key actions to generate an executing thread; 
Comparing the executing thread with a virus signature of a known virus; and 
Determining whether the executing thread matches the virus signature. 

12. The method of claim 1 1 , further comprising: 

Outputting the identification of the known virus. 

13. The method of claim 1 1, wherein the portion of the interpreted language source code 
is lexically parsed. 

14. The method of claim 1 1, wherein the portion of the interpreted language source code 
is lexically and grammatically parsed. 

15. A method for generating a virus signature from a portion of interpreted language 
source code including a computer virus, the method comprising: 

Receiving a portion of interpreted language source code containing a computer 

virus; 

Parsing the portion of the interpreted language source code containing the 
computer virus into tokens to generate tokenized source code, wherein at least some of 
the tokens represent key actions; 

Extracting key actions from the tokenized source code, 

Linearizing the key actions to generate an executing thread; 

Determining the set of minimum key actions in the executing thread required to 
effect the computer virus; and 

Storing the set of minimum key actions as a virus signature. 

16. The method of claim 15, further comprising: 

Compiling the virus signature in binary format. 

17. The method of claim 15, further comprising: 

Compiling the virus signature with data input by a virus analyst; and 
Storing the virus signature as part of a virus pattern file. 

18. The method of claim 17, wherein the virus pattern file further includes a dictionary of 
key actions. 

19. The method of claim 15, wherein the portion of the interpreted language source code 
is lexically parsed. 

20. The method of claim 15, wherein the portion of the interpreted language source code 
is lexically and grammatically parsed. 

21. A computer readable medium containing program code for identifying a computer 
virus in interpreted language source code, the computer readable medium comprising 
instructions for: 



Receiving a portion of interpreted language source code; 

Parsing the portion of the interpreted language source code into tokens to generate 
a tokenized source code, wherein at least some of the tokens represent key actions; 

Linearizing at least a portion of the key actions to generate an executing thread; 

Comparing the executing thread with a virus signature of a known computer 
virus; and 

Determining whether the executing thread matches the virus signature. 

22. The computer readable medium of claim 21 , further comprising: 

Outputting the identification of the known computer virus. 

23. The computer readable medium of claim 21, wherein the portion of the interpreted 
language source code is lexically parsed. 

24. The computer readable medium of claim 21, wherein the portion of the interpreted 
language source code is lexically and grammatically parsed. 

25. A computer readable medium containing program code for generating a virus 
signature from a portion of interpreted language source code including a computer virus, 
the computer readable medium comprising instructions for: 

Receiving a portion of interpreted language source code containing a computer 

virus; 

Parsing the portion of the interpreted language source code containing the 
computer virus into tokens to generate tokenized source code, wherein at least some of 
the tokens represent key actions; 

Linearizing at least a portion of the key actions to generate an executing thread; 

Determining the set of minimum key actions in the executing thread required to 
effect the computer virus; and 

Storing the set of minimum key actions as a virus signature. 

26. The computer readable medium of claim 25, further comprising: 

Compiling the virus signature in binary format. 

27. The computer readable medium of claim 25, further comprising: 

Compiling the virus signature with data input by a virus analyst; and 
Storing the virus signature as part of a virus pattern file. 

28. The computer readable medium of claim 27, wherein the virus pattern file further 
includes a dictionary of key actions. 

29. The computer readable medium of claim 25, wherein the portion of the interpreted 
language source code is lexically parsed. 

30. The computer readable medium of claim 25, wherein the portion of the interpreted 
language source code is lexically and grammatically parsed. 



